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ABSTRACT 



A communications network is evaluated by selectively send- 
ing and receiving a plurality of network evaluation signals 
through the network. Responsive to these evaluation signals, 
selective network evaluation parameters are determined and 
stored. Responsive to these parameters, the response t ime 
and throug h put characteristics of the network are determined 
by means ^).L_algebraic and queuing theo ry derivations . 
Neiwork response tim e_analygis determ ines The apparent 
bandwidth, utilizati on, internal m es sage sis^q ue uTTactor, 
" jn^jyrc ej^tency^ Throughput analysis defines, calculates, 
and uses hop count, duplex, throughput and multi-server 
factors. Service level and capacity planoing provides com- 
prehensive "what-if ' network planning facilities, including 
calculation of the change in network traffic before network 
response time service level is compromised; calculation of 
the additional file load capacity of the network; and deter- 
mination of tuning recommendations for recommended win- 
dow size for file transfer to fill remaining capacity. 

44 Claims, 6 Drawing Sheets 
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SYSTEM AND METHOD FOR ANALYZING 
AND TUNING A COMMUNICATIONS 
NETWORK 



BACKGROUND OF THE INVENTION 

1. Technical Field of the Invention 

This invention relates to testing and analyzing a commu- 
nications network. More particularly, the invention relates to 
measuring, monitoring, estimating, capacity planning, and 
tuning of network performance and throughput. 

2. Background Art 

Users and managers of communications networks are 
interested in the capacity, performance, reliability, 
availability, topology, service level attainment, and model- 
ing of their networks. Currently, many separate, 
incompatible, complicated, and often unsatisfactory tools 
are required to perform the tasks required by network 
managers. Existing network management and planning tools 
and methodologies suffer from at least one of the following 
current shortcomings: 

1. require user knowledge of and input of current (and/or 
proposed) network topology; 

2. require user to take a trace or multiple traces (snapshot 
of the network over a given time period) as a basis of 
analysis; 

3. require network devices, for selected network events, to 
perform calculations and store their results for subse- 
quent retrieval or periodic reporting of this information; 

4. require clock synchronization for centralized coordi- 
nation and analysis of the trace and/or stored data; 

5. analyze a network on a hop-by-hop basis, rather than as 
a whole; 

6. fail either to distinguish between or even to measure at 
all the network's response time capacity and the net- 
work's throughput capacity; 

7. require user knowledge and input of the capacity of the 
various network components (e.g., processors, 
adapters, and local and wide area links), which may be 
based upon manufacturers* or suppliers* claims that are 
erroneous or not applicable to the users* environment; 

8. require user knowledge and input of current network 
customization (e.g., tuning parameters); and 

9. provide either analysis of the current performance and 
status of the network, or an estimation of the network 
assuming user-input changed load or configuration, or 
a database of the network's past condition; but not all 
functions together as a seamless, consistent whole. 

Users and managers of networks frequently use TCP/IP 
pings (i.e., architected network echo packets) to check the 
availability of a target resource and the network connecting 
to it. In addition, ping programs commonly report the ping*s 
round trip time, and users network managers can get a feel 
for the "usual" amount of time a ping should take between 
stations A and B on their network. Topically, the ping 
function provides one way and two way transfers. In one 
way pings, an echo server sends a packet to a device which 
discards the packet and returns a time stamp to the server. In 
two way pings, the device returns the packet with the time 
stamp. 

U.S. Pat. No. 5,477,531 describes a technique of com- 
munication system analysis in which sequences of pings of 
different sizes are sent, transmitted in isolation from each 
other, in order to determine characteristics of the network 
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beyond availability of resources and "usual" response time. 
In accordance with this te chnique, the best and mean times 
for the sequences of pings of different lengths are measured, 
and th en the following are g e om etrically deriv e d via use of 
5 ^tnT reciprocal ot J the" packet size ^and-ha^j wiflfr, slo pe: "** 
the network path's bandwidth, 
the network path's propagation delay, and 
the network path's queuing time, 
1Q Further network testing involves sending bursts of pings to 
determine the loss rate of packets, from which the "internal 
packet size of the network" can then be determined. By this 
it is meant that the minimum device buffer size in the 
transmission path of the network can be discovered. The 
15 sending of bursts of pings of decreasing size is also 
described, the intent of which is to determine if smaller 
packets are prioritized over larger packets. In this way, the 
following is determined: 
the network path's minimum buffer size (also referred to 
ZQ as "internal packet size"); and 

the network's short frame prioritization capability. 
AsJsjreco e nized in this art reference^ "there will generally 
be a pluralitv_olnetwork hons between the test slalion and 
Jhe remote station, each with^tS-QWJiJa aj xdwidjlL^ In these 
25 circumstances, taking the reciprocal of the slope of the line 
as the bandwidth is equivalent to saying that: 

(l/Bandwidth>(l/i)l +1/62+ . . . 1/bn) 

where bl, b2, . . . bn are the bandwidths of all the hops in 

30 the path. This will produce a bandwidth close to accurate 
only if there is one hop in the path that is significantly slower 
than all the others. Where this is not the case, the estimate 
may be inaccurate because no account is taken of the fact 
that for a multi-hop path, the intermediate nodes will delay 

35 onward transmission of a packet until the whole packet has 
been received." 

Current network evaluation systems which send test pack- 
ets through a network require that the evaluator have knowl- 
edge of the network's internal topology, require that special 

40 proprietary code be installed in intermediate network 
devices, and do not use queuing theory or provide an 
analytic evaluation of the lest results. 

Also, current network evaluation systems which perform 
queuing evaluation of a network require that the evaluator 

45 have knowledge of the network's internal topology, require 
storage and retrieval of data from intermediate network 
devices, require assembly and analysis of network traces that 
are depictions of the network at a given time, require 
knowledge of the detailed customization of all intermediate 

50 network devices, require knowledge of the capacity of each 
intermediate network device and device interface, and 
require intensive preparation to set up and use. 

In addition, network traffic prioritization is currently 
being developed and implemented by many network equip - 

55 ment suppliers, who will provide prioritization by "type of 
service" (TOS) or "class of service" bits being set in network 
packets' headers. Consequently, there is a need for testing 
for the presence of network prioritization support and, if 
present, measuring network utilization and performance by 

60 means of discrete pings set at varying priorities. 

The objects of the invention include providing an 
improved system and method for network measurement and 
planning. 

The objects of the invention further include, for dealing 
65 with apparent bandwidth, a key concept for understanding 
the network's "response time" characteristics, providing an 
improved system and method for using "pings" of different 
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sizes to deduce aspects of network performance including: tization support and, if present, measuring network utiliza- 

determining network end-to-end bandwidth; determining tion and performance by means of discrete pings set at 

network end-to-end queue delay; determining network end- varying priorities, 
to-end propagation delay; and determining network internal 

packet size. 5 SUMMARY OF THE INVENTION 

The objects of the invention further include providing a 

system and method for: improving end-to-end bandwidth 1° accordance with the invention, a system and method is 

analysis; expanding the concept of a queue delay to one of provided for evaluating a communications network.^pjn.- 

a queue depth; and analyzing the unitary concept of end-to- ralitv ^of network evaluation signals., or ^probative test 

end "propagation delay" as including two components; that pa ckefs, are selectively sent and received through the net* 

is, (i) the end-to-end device latencies, plus (ii) the end-to- gogc. Responsive to these evaluation sjgga l s,, selective 

end (speed of light factored) propagation delay. network evaluation parameters are determined and storecT 

The objects of the invention further include providing a Queuing theory analysis, responsive to these parameters, 

comprehensive end-to-end queuing theory system and determines the response time and throughput characteristics, 

method for network analysis. including capacity, utilization and performance, of the net- 

The objects of the invention further include providing a 15 W ork. 

system and method for distinguishing between and deter- £ ^ , , r ... . . ... 

mining network response time and nelwork throughput. u 0ther Shires and advantages of this invention will 

The objects of the invention further include providing a b 1 ccome apparent from the following detailed description of 

system and method for near-instantaneous network evalua- lhe P resen tly preferred embodiment of the invention, taken 

tions that analyze the current state of the network and allow 20 m conjunction with the accompanying drawings, 

for "what if scenarios involving all performance compo- DDrcc nncnoiD^nnM Txin no A n™rc 

nents for network planning, including: determining end-to- DESCRIPTION OF THE DRAWINGS 

end network utilization; determining average message size piG. 1 illustrates a communications network and network 

in the network (this is not to be confused with "network evaluation system in accordance with the preferred embodi- 

internal packet size*', which is a measure of the minimum 25 ment of the system of invention. 

network device buffer size, not network user message sizes); FIG. 2 illustrates a representative logic flow for user 

determining end-to-end network device latencies; determin- ■ t 

ing end-to-end network propagation delay (a function of _ ' „ .„ t . „ 

distance and speed of light); determining network response [ 3 , ^«fs the logic flow of the response lime 

times for messages of any specified length under a null 30 rouUne of me P re f erred embodiment of the invention, 

network load ("estimated optimal network service level"); FIG 4 illustrates ,he lo g ic flow of the throughput routine 

determining network response times for messages of any of tne preferred embodiment of the invention, 

specified length under the current network load ("estimated FIG. 5 geometrically illustrates ping results and 

current service level"); estimating network utilization level bandwidth, utilization, and message size derivations in 

at which (a user-input) service level compliance is compro- 35 accordance with the preferred embodiment of the invention, 

mised; determining network "duplex", "hop count/* "mul- FIG. 6 illustrates five bar graphs depicting bits per second 

tiserver" and "throughput" factors (four new end-to-end transmitted and received under discrete pinging, FTP or 

measurement concepts for network analysis and capacity one-way ping streams, and 2-way ping streams, 
planning); determining optimal maximum network window 

size, based on user message size, assuming no competing 40 BEST MODE FOR CARRYING OUT THE 

traffic; estimating expected current window size for a given INVENTION 
message size at current network utilization; estimating 

change in response time and optimal window size if servers The s y stem and raethod of lhe Preferred embodiment of 

and/or users are relocated (e.g., datacenter consolidation or lhe invention combines a new network probing test frame 

move); estimating change in response time and optimal 45 transmission method with a new network analysis method 

window size if apparent network bandwidth is changed; and thal views an entire network 35 a sin S ular entil y and creates 

estimating unidirectional and bidirectional file transfer a queuing theory model for the network as a singular entity, 

throughput capacities and window sizes under null, current, In order 10 establish lhe historical, current, and predicted 

or other network load conditions. foture of stales of a network for all types of network traffic, 

It is a further object of the invention to provide a system 50 deluding interactive, browser, batch, and realtime traffic, 

and method for evaluating key network performance param- probative transmissions, including echoed and non-echoed 

eters of concern to the managers, support personnel, and P ackets > of Iike and Bering lengths, of like and differing 

planners responsible for data communication and data, network P™ 1 "^ individually and in streams, are sent and 

voice, and video communications networks. transu times measured, and queuing theory applied to the 

It is a further object of the invention to provide a system 55 resu l ts - 

and method for performing rigorous, real-time, queuing The system and raethod of the preferred embodiment of 

theory-based network analysis without need for knowledge the invention adds function to each of two known arts and 

of the components, topology or usage characteristics of the then combines them. Specifically, this method of the pre- 

network. ferred embodiment of the invention combines the hitherto 

It is a further object of the invention to provide a flexible, 60 separate arts of (1) sending probative test packets across a 

portable, easy to use network analysis method and system live data communications or data and voice communications 

which works on a live network, provides instantaneous network and (2) applying queuing theory to lhe test results 

analysis of the current condition of the network, provides the to determine the capacity, utilization, and performance of the 

capability to establish an historical database, and provides network. 

'what if analysis for future network changes. 65 Probative testing techniques previously known in the art 

It is a further object of the invention to provide a system make no use of queuing theory, and queuing theory tech- 

and method for testing for the presence of network priori- niques previously known in the art make no use of probative 
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testing. In accordance with the present invention, probative 
testing and queuing theory are combined in a new method- 
ology. In accordance with this new methodology, new con- 
cepts and means for testing to discover their values are 
provided. The subjects for probative testing are for the four 5 
principle types of network traffic, which are (1) voice/video, 
(2) client/server transaction, (3) web browser, and (4) batch 
file, print, and fax. 

Response time has four components: (1) serialization/ 
deserialization time (for a message length), (2) device 10 
latency, ( 3) propa^ation_delay r and (^) queue delays In 
accordance with the method of the invention, apparent 
bandwidth is used as the basis for deriving serialization/ 
deserialization time. Apparent bandwidth is derived by 
subtracting short ping time from long ping time (discrete 15 
pings). Pings also determine the network's latency. Network 
quality factor is used in a propagation delay formula for 
distinguishing between device latency and propagation 
delay latency. The network's queue is measured as a number 
of messages on a queue and their size, thus determining the 20 
network's average message length. Measuring the number 
of messages on the queue and their length is the key for 
application of queuing theory. 

In addition to knowing the average network message size, 
queue analysis is dependent on discovering utilization. 2 5 
Heretofore, utilization has been calculated by means of 
stored information at various points along the network for 
hop-by-hop analysis or else by estimating a message arrival 
rate, the server (i.e., network) speed, and the number of 
servers. In accordance with the invention,, probative testing 3 q 
is used to determine the state of the live network as an 
end-to-end entity rather than relying on user estimates or 
data stored in the network. In order to measure network 
utilization and apparent bandwidth and latency in support of 
queue analysis for the network, the number of messages on 35 
queue is derived from utilization. Heretofore, queuing 
theory-based methodologies derived utilization from the 
arrival rate of messages. 

In accordance with the present invention, the formula 
u/(l-u) is used for number of messages on queue and in 40 
service. Thus, the system and method of the present inven- 
tion views the network as a singular end-to-end entity. The 
number of servers ("n") must also be determined in order to 
derive the multiserver value from the formula u A n/(l-u A n). 
Prior means of calculating multiserver queue behavior 45 
involved use of Poisson distributions and Erlang functions. 
One text on queuing states: 

"As can be seen, this [Poisson, Erlang] quantity is a 
function of the number of servers and their utilization. 
Unfortunately, this expression turns up frequently in 50 
queuing calculations and is not easy to compute. Tables 
of values are readily found, or a computer program 
must be used." (Stallings, High Speed Networks: TCP/ 
IP and ATM Design Principles, Prentice Hall, 1998, pp 
162-3.) 55 
In accordance with the present invention, the formula 
u*n/(l-u A n) is provided as a new measure for queue buildup 
based on utilization for multiserver systems. It represents an 
accurate generalization of tables of the sort referred to by 
Stallings, greatly simplifies prior methods for multiserver 60 
queue analysis, and together with the new techniques 
described below for probative network testing to derive a 
value for the networks multiserver factor, provides calcula- 
tions appropriate for the testing and measurement of all 
kinds of network traffic in all topologies and for deriving 65 
queuing theory based evaluations of past, current, and future 
(i.e., "what-if" analysis of) network behavior. 



In addition to response time, the network's throughput 
characteristics is determined by streaming of pings (one 
way, with "discard"). This is used to determine the net- 
work's throughput bandwidth. The network's throughput 
bandwidth number is then divided by the apparent band- 
width number to get the network's "hop count factor," which 
in accordance with the present invention is used for relating 
the response time bandwidth of the network to the network's 
throughput bandwidth. 

Two way streaming tests for and measures the networks 
two-way thruput bandwidth. Then, dividing the two-way 
throughput by the one way throughput provides the net- 
work's "duplex factor". Additional testing provides for 
multistreamed testing, across multiple adapters, to deter- 
mine whether there are multiple paths available between the 
source and target across the network. In this manner "mul- 
tistream thruput," is derived. The multistream throughput 
divided by thruput bandwidth (or duplex thruput as 
applicable) equals the multiserver factor. This multiserver 
factor is then used to calculate a revised value for the 
equation for number of messages on queue. So where "n" is 
the multiserver factor, in accordance with the present inven- 
tion the number of messages on queue (and in service) is 
derived from u*m/(l-u*m). It is by means of discrete echo 
testing, throughput testing, the concepts and measurement of 
hop count, throughput factor, duplex factor, and multiserver 
factor, and the application of queuing theory that the full 
measure of a network's capacity and performance for all 
types of network traffic is provided by the present invention. 

The system and method of the preferred embodiment of 
the invention derives average message length for all 
priorities, derives queuing theory input for all priorities, 
determines arrival rates and utilization, stores the results in 
database, derives expected current window size, optimal 
window size, expected current average (or by percentile) 
network response time for user-input message lengths, 
derives utilization at which response time requirement is not 
met, and performs what-if analysis of such cases as change 
of location of servers or users, in utilizations (by priority), in 
utilization by user traffic pattern, in device latencies and in 
bandwidth. 

Further in accordance with the preferred embodiment of 
the invention, a system and method is provided for evalu- 
ating the four key categories of network performance of 
concern to the managers, support personnel, and planners 
responsible for data communications and data, voice and 
video communications networks. Those categories are: (1) 
performance of the network in support of single turnaround, 
response time dependent traffic, such as interactive Telnet 
and IBM 3270 traffic; (2) performance of the network in 
support of multiple turnaround, response time dependent 
traffic, such as Intranet and Internet browser traffic; (3) 
ability of the network to support throughput dependent 
traffic, such as file, print and fax traffic; and (4) ability of the 
network to support realtime traffic, such as voice and video 
traffic. 

Further in accordance with the preferred embodiment of 
the invention, the entire network under evaluation is treated 
as a unitary entity, or 'black box', that connects a client to 
a server, and a connection across this network entity is 
analyzed by sending probative test packets into the network 
and using queuing theory to assess all factors relevant to the 
network's current and future abilities with respect to each of 
the above described four network performance categories. 

In accordance with the invention, network testing is 
performed by transmitting packets among devices in or 
attached to a network, including tests (a) through (g), as 
follows: 
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(a) sending echo or discard packets (e.g., pings) of uni- nal message size, queue factor, and device latency of com- 
form length, isolated from one another by fixed inter- munications network 20. 

vals; Throughput analysis routine 34 provides for defining, 

(b) sending echo or discard packets of uniform length in calculating, and using the following new network concepts: 
a stream; S Hop Count Factor, Duplex Factor, Throughput Factor, and 

(c) sending echo or discard packets of different lengths, Multi-Server Factor. 

isolated from one another by fixed intervals; Service level and capacity planning routine 36, responsive 

(d) sending a file (or equivalent batch transfer) unidirec- t0 the ^ {cd ™* of routines 32 and 34, provides compre- 
tionally across the network, repeating with different hcnsive " w hat-if ' network planning facilities; calculation of 
packet sizes- 10 tae increase (°r change) in network traffic before network 

(e) sending a' file bidirectionally across the network, ^P 0 ?* . tim f ff™* ' levcl is compromised; calculation of 
repeating with different packet sizes; " d * onal fi , lc ^ ™P acit y of the nctwork > which * {h * 

(0 sending multiple files unidirectionally across the net- a f dd ^°" al file , bad b f™ response time is compromised 

work' and/or ^ prioritized and non-pnontized network cases); and 

' , . , - 15 determination of tuning recommendations for recommended 

(g) sending mulUple files bidirectionally across the net- window size for fik transfcf to fiU rcmaining capacity (both 

W P r V , . . respective and irrespective of maintaining response time 

In each of the above test transmissions, a transmiss,on servke , eve| and for bo , h rioritized and ^.priorf,;^ 

pnonty may be specified that varies between different types case s) 

of tests or between multiple iterations of one particular .type m 0 limized ; and other methodologi6S routincs 38 

of test. For example, runs of type (d) may be done at batch ides fof opUmized pinging> and exlensions for pingi 

(low pnonty, while runs of type (c) may be run at mterac- transaction> filc cchoi burets _ multistreaming> and unidi- 

tive (higher) pnonty. Also packets and files sent m each of rectiona , transmission and reC ordin g . 

the above test types may be sent in connect™ oriented or Fimher jn accordance with lne ferred embodiment of 

non-connection oriented modes. Echo packets and one way a (he method of ^ inven(ion lne above methodo i ogies are 

packets contain sequence numbers, Ume stamps and/or based , he sendin and receivi of . 

network priority indicators. tt 

Further in accordance with the invention, queuing theory discrete one " wa y and/or echoed P ackels 

is applied to the results of the above tests to mathematically streamed one-way and/or echoed packets 

evaluate the network under test. Four separate measures of 3Q muitistreamed one-way and or echoed packets 

the capacity or performance of the network are provided. un \ aad bi-directional file transfers 

These measure the ability of the network to transport the muitistreamed file transfers. 

following. These packets and files comprise transmission and receipt of 

1) query and response, and other transaction-type, traffic i nduslry standard packet and frame-types (e.g., TCP/IP 
within an acceptable time frame, usually referred to as 35 « ping » and "pir"), ^ we n as f rames with specialized 
'network response time' and measured in milliseconds; header and/or data content (e g ^ t ; me _ stamps and sequence 

2) a series of screen images (browser-type activity) within numbers). 

an acceptable time frame, usually measured in seconds; Various functions performed by the method of the inven- 

3) file, and other batch-type, traffic within a required tion may require some or all of the above send/receive 
period of time, often measured in minutes or hours; and 40 sequences. For example, certain functions can be performed 

4) video, voice, and other realtime -type traffic, referred to just by sending isolated pings, with no requirement for 
as the network's 'realtime traffic ability*, and usually transmission of streamed pings or file transfers, 
measured in terms of both the availability of at least the In accordance with the preferred embodiments of the 
minimum amount of network bandwidth required for invention, specified facts regarding the transmission and 
the connection and the consistency of the network's 45 receipt of these files and packets are calculated and/or 
transmission characteristics supporting the connection, recorded. These facts include, but are not limited to, number 
referred to as 'jitter', and usually measured in micro- of packets sent, number of packets received, timestamp of 
seconds or milliseconds. when packet was sent, timestamp of when packet was 

In accordance with a further embodiment of the invention, received, number of bytes in packet, packet one-way and/or 

response time and throughput in prioritized networks may be 50 round trip time, best/average/worst/standard deviation (etc.) 

calculated by first detecting whether prioritization has effect for packets of each length sent in a given sequence, and total 

in the network, determining the utilization of the network at bytes sent/received in a given unit of time, 

different priority levels, and then deriving predictive results Packet and file sending and receipt is performed from 

for current and future response time and window sizes for work station 22, which may be a dedicated network man- 

different types of service. 55 agement station or stations, a station temporarily attached to 

Referring to FIG. 1, in accordance with the preferred network 20, devices in the middle of the network 20 capable 

embodiment of the invention, apparent network speed analy- of running code 30 executing the methods of the invention, 

sis (ANSA) application 30_ executes on fflQr fasfatinn 22 to or other user stations (e.g., clients or servers) attached to or 

measure, monitor, estimate, capacity plan, and tune com- in network 20. 

munications network 20 with respect t o targef. station 24. A 60 Data concerning packet and/or file transfers and receipts 

user input device 26 and data store 28 are provided at work data is stored in data store 28 and analyzed to determine, for 

station 22, and ANSA 30 includes a response time routine example, but not limited to, the current performance of 

32, a throughput routine 34, a service level and capacity network 20 (including adherence to service-level 

planning routine 36, and optimized ping and other routines agreements), the capacity limits of the network, and the 

38. 65 current utilization of the network. The stored data is also 

Network response time analysis routine 32 provides for used for analysis of "what if scenarios" involving analysis of 

determination of the apparent bandwidth, utilization, inter- the effect on network performance and capacity of user- 



09/03/2004, EAST Version: 1.4.1 



US 6,711,137 Bl 

9 10 

specified changes to network bandwidth, changes to server in step 110, ANSA performs any or all of the functions in 

or client location (e.g., data center move), implementation of steps 132-138: 

network devices with changed latencies, or increase or In step 132, ANSA 30 performs a unidirectional file 

decrease of network utilization. The data that is obtained and transfer (FTP) or stream of unidirectional (non-echoed) 

stored is also used for network tuning recommendations 5 pings. 

(e.g., connection window sizes) and to assist in problem In step 134, ANSA 30 performs a bidirectional, concur- 
determination and capacity planning (e.g., determining the rent file transfer or stream of echoed pings, 
network utilization level at which a specified service level In step 136, ANSA 30 performs a multistreamed file 
will be compromised). This data is also used for service level transfer or unidirectional set of pings. By multistreamed is 
compliance and network availability reporting. 10 meant that multiple sockets and/or multiple network adapt- 
Ref erring to FIG. 2, in accordance with the preferred ers are concurrently used to access the same target work- 
embodiment of the method of the invention, in step 100 the station 

user signs on through input device 26 to the apparent In step 138, ANSA 30 determines network capacity by 

network speed analysis application (ANSA) 30. calculating such throughput parameters as hop count, 

In step 102, the user adjusts default values, if desired. 15 duplex, and total throughput factors, as will be described 

These default values include number of short or long pings, more fully hereafter. 

number of bytes per ping, and time between pings. Referring to FIG. 5, a geometric depiction of ping results 

In step 104, the user enters the actual average interactive and bandwidth, utilization, and message size derivations 

message size from this location, if desired, for the actual (based on the slopes of lines, perpendicular intercepts, and 

window size calculation (User Window Size Calculation) 20 other geometric relations) is illustrated. 

below. Referring to FIG. 6, five bar graphs depicting bits per 

In step 106, the user enters the IP address (or name) of the second transmitted and received under discrete pinging, FTP 

target station 24. or one-way ping streams, and 2-way ping streams are 

In step 108, the user enters the file transfer packet size. shown. The ratios for hop count, duplex, and total through- 

In step 110, the user selects any or all of hop count, 25 put factors are illustrated, and may be derived from, these 

duplex, and streaming file transfer cases if throughput analy- bar charts. 

sis is desired. Referring again to FIG. 5, Series A has three data points 

In step 112, the user selects a desired interactive at times 10, 15, and 20 milliseconds. Series A points 15 and 

(transaction response time-oriented) window recommenda- 20 represent the best ping times for frame sizes of 64 and 

lion routine and/or batch (file transfer) window estimation 30 1464 byte pings, respectively. Series B has three data points 

routine. at times 15, 20, and 25 milliseconds. Series B points 20 and 

Referring to FIG. 3, in accordance with a preferred 25 represent the average times for frame sizes of 64 and 

embodiment of the invention, the apparent network speed 1464 byte pings, respectively. Let (0,0) represent the origin 

analysis application (ANSA) 30 performs its response time point. The perpendicular (vector) from point 10 to point 0 

routine 32. 35 represent the network latency of 10 ms. The line length 

In step 120, ANSA 30 sends to target station 24 over between Series A points 10 and 15 gives the average network 

communications network 20, for example, 10 short pings of queue time (5 ms), although it is best computed by adding 

64 bytes, 10 ms apart, unless modified in step 102 to new the lengths of segments (20,15) and (25,20) and dividing by 

values. 2. The reciprocal of the slope of Series A gives the apparent 

In step 122, ANSA records the sequence numbers and 40 bandwidth (end-to-end network capacity for response time 

round trip times for the short pings. service). 

In step 124, ANSA sends, for example, 10 long pings of Apparent bandwidth measures the network path's 

1464 bytes, 10 ms apart, unless modified in step 102 to new response time capacity for discrete transactions. In accor- 

values. dance with the invention, a system and method is provided 

In step 126, ANSA records the sequence numbers and 45 for determining file/batch network throughput capacity by 

round trip times for the long pings. adding file (for one-way, therefore, half-duplex analysis) and 

In step 128, ANSA calculates, in a manner to be more ping streaming mechanisms for bidirectional (and, therefore, 

fully described hereafter, response time parameters, includ- full duplex) analysis. In addition, the system and method of 

ing the following values, from the set of long and short the invention allows for streaming pings or files in such a 
pings: apparent bandwidth, current available bandwidth^, so manner as to determine whether there exist multiple network 

currentHnavailable bandwidth," apparent utilization, appar- paths to support connections across network 20 to target 

ent latency, average queue time, apparent queue depth, station 24. The system and method of the invention thus 

apparent queue factor, apparent average network message covers network capacity for response time as well as 

length, apparent maximum user window size, estimated throughput across all network 20 topologies, 

current user window size, apparent jitter, estimated path 55 Referring again to FIG, 6, the x-axis depicts five different 

propagation delay, apparent device latency, estimated opti- bandwidth tests, designed to determine whether the network 

mal network service level, estimated current network service has full duplex, multihop, multipath, or multilink capacity, 

level, and estimated network utilization level at which The y axis represents throughput for each test in kilobits per 

service level compliance is compromised. second between two endpoints (for example, work station 22 

In these calculations, described hereafter, ANSA treats 60 and target station 24). Ping test 40 is indicative of single user 

pings that timeout (no response received) effectively as end-to-end transaction response time. FTP 42 and streamed 

100% utilization events in the calculations and also as ping 46 cases (or multistreamed versions 44 and 48) can be 

having consumed the user specified ping timeout value. used to derive multiplicative factors to determine network 

Referring to FIG. 4, in accordance with a preferred 20 capacity for utilization calculations. For example, divid- 

embodiment of the invention, the apparent network speed 65 ing streamed pings 46 throughput bandwidth by FTP's 42 

analysis application (ANSA) 30 performs its throughput throughput bandwidth gives the networks "duplex factor" 

routine 34. Responsive to user selection of cases or functions (its relative capability to handle duplex traffic). Dividing 
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FTP 42 throughput bandwidth by discrete ping 40 through- 
put (apparent bandwidth) gives the network's "hop count 
factor" (the relative contribution of multiple hops to reduc- 
ing the apparent bandwidth). Dividing streamed ping 46 
throughput by discrete ping 40 throughput gives the "total 5 
throughput factor", which is the total capacity of the network 
as compared with the apparent bandwidth — this is important 
for some utilization calculations. For mulliserver queuing 
factor, "M", the multistreamed FTP 44 value is divided by 
apparent bandwidth 40. 10 

Referring again to the geometric representations of FIG. 
5, series B line is drawn through points 25 and 15. The 
reciprocal of its slope represents the (discrete response time) 
bandwidth available in network 20. Subtracting this from the 
apparent bandwidth gives the bandwidth currently in use. 15 
Dividing bandwidth currently in use by apparent bandwidth 
and multiplying by 100 gives percent utilization. A skilled 
practitioner may wish to divide the current in use number by 
one of bandwidths 40-48 in FIG. 6 if it is determined that 
one of them is relevant to the bandwidth available for 20 
response time. 

In accordance with a specific embodiment of the 
invention, the explicit formulas calculated by ANSA 30 are 
set forth hereafter. By deriving apparent bandwidth 
(response time capacity), apparent utilization, and the net- 25 
work message size, all of queuing theory is now available 
for analytic and predictive purposes and can be applied as 
exemplified in the following formulas. The following for- 
mulas exemplify a subset of the uses for the probative testing 
and analytic methodologies enabled by the discovery of the 30 
concepts of, and means of discovering the values for, 
apparent bandwidth (network response time capacity), 
apparent utilization, the network message size, network 
latency, and the network's throughput and multi server 
factors. These new concepts, used in combination, allow 35 
derivation of the various network performance and capacity 
parameters by the general application of queuing theory. 
Apparent bandwidth (the actual maximum amount of band- 
width available, from a response time perspective, between 
the ANSA test station and the target station) — 40 
Formula: 

(long ping bits-shoit ping bits)*2/(bcst long ping ms-bcst short 
ping ms)=apparent bandwidth (1) 

Apparent bandwidth is an unitary measure of the actual 45 
effective end-to-end wire speed or bandwidth of the entire 
set of network components connecting stations across the 
network insofar as they support interactive response time. 
Data used in formula (1) is obtained by sending packets of 
different lengths. Priority bits (e.g., TCP/IP type of service) 50 
are used to distinguish levels of service in the network. 
Current available bandwidth (the actual amount of band- 
width available between the test and target stations that is 
not currently in use by other stations) — 
Formula: 5S 

(long ping bits-short ping bits)*2/(avg long ping ms-avg short 
ping ms)=current available bandwidth (2) 

Current unavailable bandwidth (the actual amount of band- 
width between the test and target stations currently in use by 
other stations) — 
Formula: 

apparent bandwidth-current available bandwidth-current unavail- 
able bandwidth (3) 

Apparent utilization (the percentage of the apparent band- 65 
width that is currently in use by other devices sharing 
portions of the network path) — 



Formula: 



60 



(current unavailable bandwidth/apparent bandwidth) "100-apparent 
utilization (4) 

Apparent latency (the sum of all propagation delays plus all 
device processing delays within the network between the 
test and target stations, one way). Without loss of generality, 
best long ping result or averaged combination of best long 
and best short ping could be used. 
Formula: 

(best short ms-(number of short bits/apparent bandwidth))/2 (5) 

Average queue (the time in ms that 50th percentile packets 
(#) spend on queue). Without loss of generality, long ping or 
averaged combination of long and short pings could be used. 
Formula: 



(average short ms-best short ms)/2=average queue ms 



(6) 



(Formulas (1) through (6), supra, are illustrated in the 
geometric representations of FIG. 5, as previously 
described.) 

Apparent queue depth (the average number of bytes in 
network buffer and processor queues between the test and 
target stations) — 
Formula: 

apparent bandwidth* apparent queue depth/8=apparcnt queue depth 
(two way) (7) 

Apparent queue factor (the average number of packets in 
network queues between the test and target stations, round 
trip, assumes MM1, single server queuing.) 
Formula (apparent utilization is expressed as a decimal in 
this formula): 

apparent utilization/(l -apparent utilization)=apparent queue fact$8) 

Apparent queue factor is used for end-to-end network 
measurement, and is derived from apparent utilization. 
The apparent queue factor formula in (8) is for single server 
queue systems. This can be adjusted for multiserver queue 
analysis by using the multiserver factor derived from the 
previously described throughput tests (b), (d), (e), (f), and 
(g) compared with the discrete packet send tests results of (a) 
and (c), as follows: 

(8.1) Compare discrete ping result's apparent bandwidth 
with FTP determined bandwidth. FTP bandwidth 
should be greater than or equal to apparent bandwidth. 
Theoretically, in a 2 hop network 20 with equal speed 
hops, FTP bandwidth will be twice the apparent band- 
width. 

(8.2) Compare the streamed ping (or a bidirectional FTP) 
bandwidth to the FTP bandwidth. If the network is full 
duplex, theoretically, the streamed ping bandwidth will 
be twice the FTP bandwidth. 

(8.3) Compare the multistream FTP (i.e. a file transfer or 
unidirectional ping stream to separate sockets for true 
concurrency) to the single FTP. It should be greater 
than or equal to the single stream. If so, the ratio 
represents the "multiserver factor," used in queuing 
theory in utilization formulas. In ANSA 30, utilization 
is used to derive the network message size. For a 
multiserver factor of value n, n would be used as an 
exponential value in the formula. 

Using the notation "3*2" to mean "3 to the power 2", the 
formula for a system with n servers (a factor of n), the 
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apparent bandwidth is adjusted to the value of an FTP or point pinging over an otherwise empty network connection 

streamed ping (or mullistream version of either of these), by between devices separated by a wide area network for which 

calculating the utilization V, and then using the formula the connection's distance and end-device latencies are 

known. Then total ping bits*2 is divided by apparent band- 

""n/O-u n), ( 9 ) 5 width to get the ping round trip service time. Each end 

to derive the apparent queue factor, from which the net- f e , vice U ^V & t multi P lied b . y I™, '° *? T?V?P 

. , . , , . . latency. The distance (in miles)*2/speed of light (in rnphl 

works average message size may be derived. . tJ -\ L , A . v , ~ & v , f / 

SA .. „ % . ° .... .. j , yields the round trip speed of light delay. Then, round trip 

Mathematically, for a given utilization and queue depth, as 4 . , , \ " • . / • i • 

n (number of servers) increases, the queue factor decreases, f "* ^~(™ nd *V service amc+round trip device 

which means message size is greater (i.e., there are fewer, 10 ^ncy+round tnp speed of light delay) yields the round trip 

but larger messages) This is important for predicting both " ct ^ ork ffV dela J ^ ^ ™T H qual ' ty dc * y 

,,- . /„ - ot - _ • _ t . *[ time/round trip speed of light equals the network quality 

response time and variation in response time. c 4 t iL c- , * ' 

a „ ront „ ot „, rtr u mat , £ ,™ i 0 „„tK /» u „ factor. This represents the proportion of time that a wide area 

Apparent average network message length (the average . • j , . i ■ . . . 

length of all queued and in service messages from all users ne P r0Vlders " etwork ^P™^ ««««*. and physi- 

between the test and target systems)- 15 cal "! crease ' he T delay ° Ver that eXp6Cted 

Formula* merely by the speed 01 light tactor. 

Apparent device latency (processing time total for the net- 
apparent queue depth/apparent queue factor-apparent average net- Work devices along the path) 
work message length (10) Formula: 

20 

Apparent maximum user Window Size (the connection-level apparent latency-estimated path propagation delay=apparent 

window size, based upon average user message length, in device latency (15) 

bytes, one way, input by the user)— In accordance with the invention, apparent device latency is 

formula. derived by viewing the network as a single device with a 

(((average user message length+acknowledgment message ^ singular latency value. 

length)*8)/apparentbandwidth)+a PP arentiaUncy)/averageuser Estimated optimal network service level (based on user 

message length (11) input of application-level input and output message 

lengths) — 

The derivation of apparent maximum user window size Formula- 
involves apparent bandwidth. It is illustrative to compare 30 

this concept with apparent utilization and apparent average (user message length/apparent bandwidth)+(apparent latency*2)= 

network message length. These latter two are new concepts estimated optimal network service level (16) 

that apply what had previously been construed of only on a Estimated current network service leve] (based on mer { , 

hop-by-hop basis to the network across all hopes Maximum of a lication _ level { t and out t u ^ er m ie ^ 

window size is a concept which has always applied end- to- 35 without loss of generality for 50th percentile responses)- 

end, but heretofore has been derived from a hop by hop Formula- 
analysis. 

Estimated current user window size — (user message length/apparent bandwidth)+(average queue time+ 

Formula: apparent latency) *2-estimated current network service 

level (17) 

40 

(((average user message length+acknowledgment message . ..... 

length) ^/current available bandwidthj+apparent latency)/aver- Estimated network Utilization level at which service level 

age user message length -estimated current user window compliance is compromised (user inputs a time value, t, and 

si2e 0 2 ) ANSA 30 determines the network utilization level that will 

Apparent jitter (the statistical variation between ping results A< ~ without loss of generality (for this could be done for 

expressed as the standard deviation)- 45 90[h ° r ^ 0t , he / P eccentlle )- an ave ™g e res P° nse ° f 1 

Formula- in network.) 

Formulas: first perform an internal mathematical check that 

(standard deviation of short pings+standard deviation of long estimated optimal network service level V is less than or 

pings)/2 (13) equal to *t 5 , the target value, where 

50 

Estimated path propagation delay (user inputs one Way a^network latency+(number of bytes per message/apparent band- 
mileage between end points and a network quality factor of width)]. (18) 
between 1,5 and 2.5, default-2)- Jf t>a> nQ further caIculation is pcrformed and lhe service 
ormu a * level is flagged as unattainable. 

(one way mileage/1 86000) -network quality factor-estimated path 55 If a=t thcn utilization must be 0%. 

propagation delay (14) If a <t, then, subtract, 

Without loss of generality, kilometers or other measure of (19) 

distance can be used, as can use of other network quality , . . „ . . , 

, f u r t . . , iU . ji ■ * so that q is the maximum allowable average queue time that 

default ranges Estimated path propaganon delay «, in 60 wi „ CQ 4 , wjth , he ired B ne ^ ork ^ 

accordance with the invention, derived from the network : , . , TT ,... \. , , . ...» . . 

... r . r™ t , i.e.. . . , ti me service level, t. Utilization u is derived by determining 

quality factor. The network quality factor is a constant value - . ' . ... 1( \. . % 

j . -j ... c \ J . - . c the queue factor that will result, on average, with a value of 

derived either from general experience or from specific T j . . . . t . ' . & * t . , . ... r 

- . & A . „ r .... q. Having previously determined the apparent bandwidth of 

testing of a given connection. For current high quality, wide 1 . f «. , / t , .1 ( » 

& A f A . , a^?t,\ tj the network b and the average network message size l m , 

area network connections, such as over AT&T, WorldCom, 65 Der f orm 

Sprint, and Nippon Telephone and Telegraph) a default value ^ 

of 2 is appropriate. The value is best derived by point to (<7xb)/8-^ {20) 
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so *z' is the number of bytes on network queues. Then as the network throughput bandwidth divided by the appar- 

divide, ent bandwidth for relating the respond time bandwidth of the 

network to the network throughput bandwidth, while two 

zlm ( 21 ) way streaming is performed to test for two way throughput 

..... , « l * l 5 bandwidth. Two way throughput bandwidth is divided by the 

which is the network queue factor at which response time , . , ; ' , & . J*. . , . , . / . 

i i *■ i l-l.l- * network throughput bandwidth to derive the duplex tactor 

equals t. The utilization level u at which this occurs is: - . b . r , . , . , . r , ., 

n tor the network; and true queue depth is denved as the 

K=((z/m)/(l+(z/m)))"(i/rt). (22) network throughput bandwidth times network queue time 

divided by 8. Multistream throughput is derived selectively 
where u is the utilization in decimal, so multiply by 100 for 10 responsive to one way streaming or two way streaming, with 
percent. From formula (22) V is the indicator of the two way streaming being used when the duplex factor is 
multiserver factor of the network. For the single server greater than 1, and otherwise one way streaming being used, 
queue case (also referred to as the MM1 case), or where A multiserver factor is derived as the multistream through- 
throughput testing will not be performed, n=l. Therefore, u put divided selectively by the throughput bandwidth or the 
represents the maximum utilization level at which service 15 duplex throughput bandwidth. A revised value for the num- 
level compliance can be achieved on average. ber of messages on queue is derived as u A m/(l-u A m), where 

Important aspects of the preferred embodiment of the m is the multiserver factor. Whether there is prioritization 

invention are set forth in the formulas (18)-(22) for esti- within the network based on packet size is detected, and 

mated network utilization at which service level compliance network prioritization based on type of service (selected 

is compromised, for both ANSA end-to-end type network 20 from the set including interactive service, browser service, 

performance and network queuing analysis, as well as for batch service, and real time service) is derived by calculating 

"non-ANSA" hop by hop traditional analysis. apparent bandwidth using highest priority packets, where 

Formulas (1) through (22) provide a basis for a new the highest priority packets are those for the service with the 

end-to-end network queuing theory methodology. By pro- best long minus best short packets; calculating utilization at 

viding a system and method for determining network speed, 25 highest priority from average long packets minus best short 

utilization, total latency, and latency broken up into device packets; calculating utilization of second highest priority 

and propagation delay components, the questions generally from average second level packets minus best highest level 

asked for detailed network analyses for capacity planning, packets, where total perceived minus highest priority utili- 

recovery, and service level compliance (such as response zation is the total second level packets; and repeating the 

time, reachability, and availability) are readily answered. By 30 calculating steps for all levels of service so that the value for 

this invention answers are provided to such questions as, for apparent bandwidth for the connection as a whole and the 

example, what will be the effect on response time if a server value for current bandwidth utilized by each network traffic 

is moved, some network devices are removed and replaced priority level is obtained. Users skilled in the art will 

with devices with different latencies, network utilization or recognize that network prioritization algorithms can be 

link speed is changed, or a satellite connection is changed, 35 FIFO (first in, first out), or that some percentage of higher 

or any combination of these? priority frames are handled and then high priority service is 

In accordance with a preferred embodiment of the interrupted for temporary lower priority queue service. The 
invention, a method for network measurement and planning following example illustrates how to account for the fact that 
is provided. Probative test packets are sent across a live prioritization is not necessarily all FIFO within priority, 
communications network to derive test results and queuing 40 Suppose that, for every four frames of highest priority sent, 
theory is applied to the test results to determine the capacity, that one frame of the second highest level is sent. Therefore 
utilization and performance of the network. Traffic on the an optional "priority service factor" is included for each 
network may include one or more of voice and video traffic, level tested, as to how many of its frames are sent for every 
client server transaction traffic, web browser traffic, and one of its successively lower priority traffic stream. This is 
batch file, print and fax traffic. Measurement of responsive 45 then combined with the overall utilization number for all 
time includes measurement of the response time components priorities to revise the estimate of utilization by priority 
of serialization or deserialization time, device latency, level. For example, in a two priority network, with one low 
propagation delay and queue delay. Apparent bandwidth is priority frame sent for every four high priority frames when 
calculated as the difference between short ping time and long there's a queue, if overall high priority utilization is high, 
ping time for discrete pings, and for a given message length 50 then approx one fifth of that utilization would have been 
the serialization or deserialization time is calculated as a lower priority traffic that was allowed through, and high 
function of apparent bandwidth; device latency is a function priority actual traffic is down adjusted and lower priority 
of ping times; propagation delay is a function of network utilization is upward adjusted, each by approx 20%. 
quality factor; and device latency and propagation delay Further, in accordance with the method of the invention, 
latency are distinguished as a function of the network quality 55 network measurement and planning includes, responsive to 
factor. Queue delay is determined by measuring the queue as probative testing on a live network and application of 
a number of messages on queue as a function of network queuing theory to the results of the probative testing, deriv- 
utilization level and the size of said messages as the average ing current propagation delay, latency, utilization by priority, 
network message length. Probative testing is used to deter- bandwidth, hop count, duplex, and multiserver factors; and 
mine the state of the network as an end-to-end entity; and the 60 responsive to these factors determining average message 
number of messages on queue and in service is u/(l-u), length for all priorities, queuing theory input for all 
where u is the network utilization level. The multiserver priorities, arrival rates, utilization, current window size, 
value is derived as u*n/(l-iTn), where n is the number of optimal window size, expected current average network 
servers in the path through the network. The throughput response time, and utilization at which a response time 
characteristics of the network are determined, including the 65 requirement is not met. Network performance may be fur- 
network throughput bandwidth which is derived by stream- ther evaluated responsive to a case selected from the set of 
ing pings one way with discard. A hop count factor is derived cases including a change of location of servers or users; a 



09/03/2004, EAST Version! 1.4.1 



US 6,711,137 Bl 

17 18 

change in utilization by priority; a change in utilization by 2. User inputs current NQF and expected future NQF for 

user traffic pattern; a change in device latencies; and a after the move. 

change in bandwidth. 3. Old propagation delay (old distance*2*old NQF/186000). 

Network managers and planners are interested in current 4. New propagation delay (new distance*2*new NQF/ 

performance of the network with respect to service level 5 186000). 

targets and in "what-if planning scenarios. Four routines 5. New propagation delay-old propagation delay-change in 

follow to describe how the probative testing results and the response time resulting from the move, 

application of the above queueing theory concepts and (Note, this does not affect queuing, however, it does affect 

formulas apply to service level attainment and what-if window size calculations). 

planning scenarios. 10 ROUTINE 3 — CHANGE IN BANDWIDTH 

ROUTINE 1— NETWORK SERVICE LEVEL Another what-if question involves changes to the net- 

ATTAINMENT work's bandwidth, and answers the question, if bandwidth 

This routine measures current network performance chan e e f> what wiu the effect be on response time? The 

against a. service level target for response time at the network « network s apparent bandwidth and current utilized band- 

(and not application) level. This will help network managers wi f h ( m blts P er ^ have been Piously calculated 

determine and prove whether or not there's a network an " store d. 

problem when users experience poor response time. 1. User inputs the new bandwidth in bits per second and keys 

f in the round trip message size. 

It works as tollows: 2 Calculate new % ut ilization-(current utilized bps/new 

. User inputs total round-trip number or characters tor a bandwidth}* 100 

transaction. Example: 80 characters in, 860 characters 3 ulilizalion b /new bandwidtn b s . v (where -y- 

out=940 characters is the utilization factor) 

. User inputs network service level attainment agreement 4 tj^.tj^q (i . e . ; the new quelle factor) . 

numbers (acceptable number °f seconds or milliseconds 5 A m s ize*8*Q=average # bits on queue. 

for, for example, the 50th and 90th percentile cases. fi A e # ^ Qn /new bandwidth=average 

Example: 50 percent within 0.050 seconds, 90 percent delay ms 

within 0.150 seconds 7. Old average delay =old q factor x average message size* 8 

3. Use apparent bandwidth value for the calculation (total 0 kt n „° M j fl „„ n „„ nM , . , . a ■ ann 

K ir t sQ ^ / t « • °. New average delay-old average delay=cnange ui mean 

— "" ~ 3Q response time. 



number of characters* 8)/app a rent bandwidth="service 
time" for transaction, 



A „ , . „ A ^ T „ „ . , . r „ Optionally, the user may apply a multiserver factor to the 

4. From the series of ANSA pings, calculate the following: formula q{ 4 ab jf & ^ knQWn 

[(5th best long ms-best long ms)+(5th best short ms best 

short ms)]/2=50th percentile queue time, and [(9th best ROUTINE A — CHANGE IN UTILIZATION 

long ms-best long ms)+(9th best short ms-best short 35 This routine answers the question, what is effect of change 

ras)]/2»90th percentile queue time. in utilizalion on rcS p 0nS e time? 

5. Calculate the total network latency "L" (this has already L User puts in a po silivc or nega tive percent change in 
been derived by): [(best long ms+bcst short ms)/2]-[(long utilization (e.g. +10% or -8%), and an average round trip 
# characters+short# characters)*8]/appbw=L (where L is message size in number of characters. 

total net latency, that is, propagation delay plus device ^ 2 Currcnt utilization %+ch ange in utilization %-U (where 

latency; and appbw is an abbreviation for 'apparent y ^ the ncw ^{^{{0x1 %). 

bandwidth')- 3, U/(1-U)=new queue factor. (Use multiserver factor, if 

6. The results from steps 3, 4, and 5 are combined to derive applicable) 

the 50th percentile and 90th percentile response times as 4 New queue f act0 r*average message size*8/appbw new 

fo,lows: 45 queue delay. 

50th percentile queue time+modem time for transaction+ 5, N ew queue delay-old queue delay^change in response 

L=50th percentile network response time, and time. 

90th percentile queue time+modem time for transaction+ 6. Add this to the modem time plus latency to get the new 

L-90th percentile network response time. average response time. 

7. A best network time (i.e., 0% queue) is then calculated for r n , 

the transaction: best network time-modem time for Advantages Over the Prior Art 

transaction+L. The advantages of the system and method of the preferred 

embodiment of this invention include providing an 

2ND ROUTINE— EFFECT ON NETWORK improved system and method for network measurement and 

PERFORMANCE OF MOVING USERS OR ss planning. 

SERVERS jjj e ac j van t a g es 0 f the system and method of the preferred 

This routine answers the question what if there is a embodiment of this invention include, for dealing with 

datacenter move or what if users are moved? What is the apparent bandwidth, a key concept for understanding the 

effect on response time? This question is a propagation delay network's "response time" characteristics, providing an 

(distance) issue, and is solved by use of propagation delay, eo improved system and method for using "pings" of different 

which equals one way distance* 2* NQF, where NQF is the sizes to deduce aspects of network performance including: 

network quality factor (default=2, and expected range is 1.4 determining network end-to-end bandwidth; determining 

to 2,5). network end-to-end queue delay; determining network end- 

The calculations for the movement of users or servers are to-end propagation delay; and determining network internal 

as follows: 65 packet size. 

1. User inputs current 1 way distance between users and The advantages of the system and method of the preferred 

servers and the proposed new distance between them. embodiment of this invention include providing a system 
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and method for: improving end-to-end bandwidth analysis; 
expanding the concept of a queue delay to one of a queue 
depth; and analyzing the unitary concept of end-to-end 
"propagation delay" as including two components; that is, 
(i) the end-to-end device latencies, plus (ii) the end-to-end 5 
(speed of light factored) propagation delay. 

The advantages of the system and method of the preferred 
embodiment of this invention include providing a compre- 
hensive end-to-end queuing theory system and method for 
network analysis. 1° 

The advantages of the system and method of the preferred 
embodiment of this invention include providing a system 
and method for distinguishing between and determining 
network response time and network throughput. 

The advantages of the system and method of the preferred 
embodiment of this invention include providing a system 
and method for near- instantaneous network evaluations that 
analyze the current state of the network and allow for "what 
if" scenarios involving all performance components for 
network planning, including: determining end-to-end net- 
work utilization; determining average message size in the 
network (this is not to be confused with "network internal 
packet size", which is a measure of the minimum network 
device buffer size, not network user message sizes); deter- 
mining end-to-end network device latencies; determining 
end-to-end network propagation delay (a function of dis- 
tance and speed of light); determining network response 
times for messages of any specified length under a null 
network load ("estimated optimal network service level"); 
determining network response times for messages of any 
specified length under the current network load ("estimated 
current service level"); estimating network utilization level 
at which (a user-input) service level compliance is compro- 
mised; determining network "duplex", "hop count," and 
"throughput" factors (three new end-to-end measurement 
concepts for network analysis and capacity planning); deter- 
mining optimal maximum network window size, based on 
user message size, assuming no competing traffic; estimat- 
ing expected current window size for a given message size 
at current network utilization; estimating change in response 
time and optimal window size if servers and/or users are 
relocated (e.g., datacenter consolidation or move); estimat- 
ing change in response time and optimal window size if 
apparent network bandwidth is changed; and estimating 
unidirectional and bidirectional file transfer throughput 
capacities and window sizes under null, current, or other 
network load conditions. 

It is a further advantage of the invention that there is 
provided system and method for evaluating key network $Q 
performance parameters of concern to the managers, support 
personnel, and planners responsible for data communication 
and data, voice, and video communications networks. 

It is a further advantage of the invention that there is 
provided a system and method for performing rigorous, 5S 
real-lime, queuing theory-based network analysis without 
need for knowledge of the components, topology or usage 
characteristics of the network. 

It is a further advantage of the invention that there is 
provided a flexible, portable, easy to use network analysis 60 
method and system which works on a live network, provides 
instantaneous analysis of the current condition of the 
network, provides the capability to establish an historical 
database, and provides 'what if analysis for future network 
changes, 65 

It is a further advantage of the invention that there is 
provided a system and method for testing for the presence of 
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network prioritization support and, if present, measuring 
network utilization and performance by means of discrete 
pings set at varying priorities. 

Alternative Embodiments 

It will be appreciated that, although specific embodiments 
of the invention have been described herein for purposes of 
illustration, various modifications may be made without 
departing from the spirit and scope of the invention. In 
particular, it is within the scope of the invention to provide 
a program storage or memory device such as a solid or fluid 
transmission medium, magnetic or optical wire, tape or disc, 
or the like, for storing signals readable by a machine for 
controlling the operation of a computer according to the 
method of the invention and/or to structure its components 
in accordance with the system of the invention. 

Further, each step of the method may be executed on any 
general computer system, such as an IBM System 390, 
AS/400, PC or the like and pursuant to one or more, or a part 
of one or more, program modules or objects generated from 
any programming language, such as C++, Java, Pl/1, For- 
tran or the like. And still further, each said step, or a file or 
object or the like implementing each said step, may be 
executed by special purpose hardware or a circuit module 
designed for that purpose. 

Accordingly, the scope of protection of this invention is 
limited only by the following claims and their equivalents. 

We claim: 

1. A program storage device readable by a machine, 
tangibly embodying a program of instructions executable by 
a machine to perform a method for network measurement 
and planning, said method comprising: 

sending probative test packets across a live communica- 
tions network to derive network evaluation parameters 
including apparent bandwidth and current available 
bandwidth; 

determining capacity, utilization and performance of said 
network as a function of said network evaluation 
parameters and of queue delay selectively determined 
with respect to single or multiple links apparent queue 
factor; 

measuring responsive time including response time com- 
ponents of serialization or deserialization time, device 
latency, propagation delay and queue delay; 

determining apparent bandwidth as a difference between 
short ping time and long ping time for discrete pings; 

determining for a given message length serialization or 
deserialization time as a function of apparent band- 
width; 

determining device latency as a function of ping times; 
determining propagation delay as a function of network 
quality factor; 

distinguishing between device latency and propagation 
delay latency as a function of said network quality 
factor; and 

determining queue delay. 

2. The program storage device of claim 1 wherein traffic 
on said network includes one or more of voice and video 
traffic, client server transaction traffic, web browser traffic, 
and batch file, print and fax traffic. 

3. The program storage device of claim 1, said determin- 
ing queue delay including measuring the queue as a number 
of messages on said queue as a function of network utili- 
zation level and size of said messages as average network 
message length. 
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4. The program storage device of claim 3, said method testing for network prioritization based on type of service 
further comprising: selected from a set including interactive service, 

using probative testing to determine the state of said browser service, batch service, and real time service; 

network as an end-to-end entity; and including 

deriving the number of messages on queue and in service 5 calculating apparent bandwidth using highest priority 

as u/(l-u), where u is said network utilization level. packets, where said highest priority packets are those 

5. The program storage device of claim 4, said method for the service with best long minus best short 
further comprising: packets; 

deriving the multiserver value as u A n/(l-u A n), where n is calculating utilization at highest priority from average 

the number of servers in the path through said network. long packets minus best short packets; 

6. The program storage device of claim 5, said method calculating utilization of second highest priority from 
further comprising: average second level packets minus best highest 

deriving the throughput characteristics of said network, level packets, where total perceived minus highest 

including the network throughput bandwidth. 15 priority utilization is said total second level packets; 

7. The program storage device of claim 6, said network and 

throughput bandwidth being determined by streaming pings repeating said calculating steps for all levels of service, 

one way with discard, 16. A method for network measurement and planning, 

H. The program storage device of claim 7, said method comprising the steps of: 

further comprising: 2 o responsive to probative testing on a live network and 

deriving a hop count factor as said network throughput selective calculation and application of single and 

bandwidth divided by apparent bandwidth for relating multiple links apparent queue factor to the results of 

said respond time bandwidth of the network to said said probative testing, deriving current propagation 

network throughput bandwidth. delay, latency, utilization by priority, bandwidth, hop 

9. The program storage device of claim 8, said method 25 count, duplex, and multiserver factors; and responsive 
further comprising performing two way streaming to test for thereto 

two way throughput bandwidth. determining average message length for all priorities, 

10. The program storage device of claim 9, said method arrival rates, utilization, current window size, optimal 
further comprising: window size, expected current average network 

dividing said two way throughput bandwidth by said 30 response time, and utilization at which a response time 

network throughput bandwidth to derive the duplex requirement is not met. 

factor for said network; and 17. The method of claim 16, comprising the further step 

deriving true queue depth as said network throughput of evaluating network performance responsive to a case 

bandwidth times network queue time divided by 8. selected from a set of cases including a change of location 

11. The program storage device of claim 10, said method 35 of servers or users; a change in utilization by priority; a 
further comprising: change in utilization by user traffic pattern; a change in 

deriving multistream throughput selectively responsive to de ™ e latencies ; and a cha "S e » bandwidth. 

one way streaming or two way streaming, with two way . 18 * A method for evaluatin £ a communications network 

streaming used when said duplex factor is greater than interconnecting a workstation and a target stahon, compris- 

1, and otherwise with one way streaming. 40 ing the steps °f : 

12. The program storage device of claim 11, said method communicating long ping bits; 
further comprising: communicating short ping bits; 

deriving a multiserver factor as said multistream through- determining the best long ping time; 

put divided selectively by said throughput bandwidth 45 determining the best short ping time; and 

or said duplex throughput bandwidth. , , . . . ... « c , 

i »™ r 4 5 • • j , calculating apparent bandwidth as a function of the nu m- 

1J. the program storage device or claim 12, said method . . ... , c , ^ . ., 

further com risin ^ ? in ^ number of short ping bits, said 

u r comprising. ^ est j on g . time, and said best short ping time, 

deriving a revised value for the number of messages on 19 ^ method of daim 18 &rlher comprising lhe steps 

queue as u"m/(l-u~m), where m is said multiserver 50 0 f. 

N^/program storage device of claim 1, said method determining average long ping time; 

further comprising detecting for prioritization within said determining average short ping time; and 

network based on packet size. calculating the current available bandwidth as a function 

15. A program storage device readable by a machine, 5S of said number of long ping bits, said number of short 

tangibly embodying a program of instructions executable by ping bits), said average long ping time, and said aver- 

a machine to perform a method for network measurement age short ping time. 

and planning, said method comprising: 20. The method of claim 19, further comprising the step 

sending probative test packets across a live communica- °^ 

tions network to derive network evaluation parameters 60 calculating the current unavailable bandwidth as equal to 

including apparent bandwidth and current available said apparent bandwidth minus said current available 

bandwidth; bandwidth, 

determining capacity, utilization and performance of said 21. The method of claim 20, further comprising the step 

network as a function of said network evaluation °£ 

parameters and of queue delay selectively determined 65 calculating apparent utilization of said network as said 

with respect to single or multiple links apparent queue current unavailable bandwidth divided by said apparent 

factor; bandwidth. 
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22. The method of claim 18, further comprising the step 32. The method of claim 31, comprising the further step 



of: 



of: 



of: 



of: 



calculating apparent latency selectively as a function of 
said best short ping time, said short ping bits, and said 
apparent bandwidth or as a function of said best long 
ping time or as a function of averaged combination of 
said best long ping time and said best short ping time. 

23. The method of claim 22, further comprising the step 

f: 

calculating average queue time selectively as a function of 
said average short ping time and said best short ping 
time, or as a function of said long ping time, or as a 
function of an averaged combination of said long ping 
time and said short ping time. 

24. The method of claim 23, further comprising the step 

F: 

calculating apparent two way queue depth as a function of 
said apparent bandwidth and apparent queue depth. 

25. The method of claim 21, further comprising the step 

f: 

calculating apparent queue factor as a function of said 
apparent utilization. 

26. The method of claim 25, further comprising the steps 



of: 



of: 



of: 



of: 



of: 



of: 

calculating apparent device latency as a function of said 
apparent latency and said estimated path propagation 
delay. 

33. The method of claim 31, comprising the further step 
f: 

calculating estimated optimal network service level as a 
function of said user message length, said apparent 
10 bandwidth, and said apparent latency. 

34. The method of claim 33, comprising the further step 
f: 

calculating estimated current network service level as a 
function of said user message length, said apparent 
15 bandwidth, said average queue time, and said apparent 
latency. 

35. The method of claim 34, comprising the further step 



of: 



of: 



of: 
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adjusting the value of said apparent bandwidth to the 
value of an FTP or streamed ping, or multistream 
version of said FTP or streamed ping; and 

calculating apparent queue factor as a function of said 
utilization and a multiserver factor, said multiserver 30 
factor representing the ratio of said multistream FTP to 
said single FTP. 

27. The method of claim 26, further comprising the step 



calculating apparent average network message length as a 35 
function of said apparent queue depth and said apparent 
queue factor. 

28. The method of claim 27, further comprising the steps 

f: 

determining the acknowledgment message length; 

calculating apparent maximum user window size as a 
function of said average user message length, said 
acknowledgment message length, said apparent 
bandwidth, and said apparent latency. 

29. The method of claim 28, further comprising the step 

f: 

calculating estimated current user window size as a func- 
tion of said average user message length, said acknowl- 
edgment message length, said current available 
bandwidth, and said apparent latency. 

30. The method of claim 29, further comprising the steps 

f: 

determining the standard deviation of said short ping 
times; 

determining the standard deviation of said long ping 
times; and 

calculating apparent jitter as a function of said standard 
deviations of said short pint times and said long ping 
times, 60 

31. The method of claim 30, further comprising the steps 

f: 

establishing a network quality factor; 

determining distance between said work station and said 

target station; and 55 
calculating estimated path propagation delay as a function 

of said network quality factor and said distance. 
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calculating estimated optimal network service level as a 
function of said network latency, said message size, and 
said apparent bandwidth. 

36. The method of claim 35, comprising the further steps 
f: 

establishing a target value; 

if said estimated optimal network service level is greater 
than said target value, flagging the service level as 
unattainable; 

if said estimated optimal network service level is less than 
or equal to said target value, then calculating the 
maximum allowable average queue time as a function 
of said estimated optimal network service level and 
said target value. 

37. The method of claim 36, further comprising the step 
f: 

calculating the network queues size as a function of said 
apparent bandwidth and said maximum allowable aver- 
age queue time. 

38. The method of claim 37, further comprising the step 
f: 

calculating the network queue factor at which response 
time equals said target as a function of said network 
queues size and said average network message size. 

39. The method of claim 38, further comprising the steps 
of: 

determining the multiserver factor; 

calculating the utilization level at which said response 
time equals said target as a function of said network 
queues size, said average network message size, and 
said multiserver factor. 

40. Method for evaluating a communications network, 
comprising the steps of: 

probative testing a live communications network by selec- 
tively sending and receiving a plurality of network 
evaluation signals through said network; 

calculating and applying single and multiple links appar- 
ent queue factor to said network evaluation signals, for 
deriving network evaluation parameters including 
apparent bandwidth and current available bandwidth, 
current propagation delay, latency, utilization by 
priority, hop count, duplex, and multiserver factors; 

responsive to selected said network evaluation 
parameters, analyzing average message length for all 
priorities, arrival rates, utilization, current window size, 
optimal window size, expected current average net- 
work response time, and utilization at which a response 
time requirement is not met; and 
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responsive to selected said network evaluation 
parameters, analyzing the throughput of said network. 

41. A method for evaluating a communications network, 
comprising the steps of: 

selectively sending and receiving a plurality of network 5 
evaluation signals through said network, said network 
evaluation signals being selected from the set of signals 
including discrete one-way echoed packets, discrete 
echoed packets, streamed one-way packets, streamed 
echoed packets, multistreamed one-way packets, mul- 10 
tistreamed echoed packets, uni-directional file 
transfers, bi-directional file transfers, and multi- 
streamed file transfers; 

responsive to said network evaluation signals, selectively 
recording network evaluation parameters selected from 35 
the set of parameters including number of packets sent, 
number of packets received, packet send time stamp, 
packet receipt time stamp, packet size, packet one-way 
trip time, packet round trip time, standard deviation, 
and bytes transferred per unit of time; 20 

responsive to selected said network evaluation 
parameters, analyzing the response time of said 
network, including determining at least one of factors 
defining the apparent bandwidth, current available ^ 
bandwidth, current unavailable bandwidth, apparent 
utilization, apparent average message size, apparent 
maximum user window size, estimated current user 
window size, apparent jitter, estimated path propaga- 
tion delay, estimated optimal network service level, 30 
estimated current network service level, estimated net- 
work utilization level at which service level compliance 
is compromised, average queue time, apparent queue 
depth, apparent queue factor, and apparent device 
latency of said network; 35 

responsive to selected said network evaluation 
parameters, analyzing the throughput of said network, 
including determining the hop count factor, duplex 
factor, throughput factor, and multi-server factor of said 
network; 40 

responsive to user selection, executing one or more ser- 
vice level and capacity planning routines selected from 
the set including routines for planning network 
characteristics, calculating the change in network traffic 
before network response time level is compromised, 45 
calculating the additional file load capacity of said 
network, and for determining window size for file 
transfer to fill remaining capacity; and 

further responsive to user selection, selectively executing 
optimized ping, ping extensions, transaction, file echo, 50 
bursts, multistreaming, and unidirectional transmission 
and recording routines. 

42. A system for evaluating a communications network, 
comprising: 

means for probative testing a live communications net- 55 
work by selectively sending and receiving a plurality of 
network evaluation signals through said network; 

means for calculating and applying single and multiple 
links apparent queue factor to said network evaluation 6Q 
signals for selectively deriving and recording network 
evaluation parameters including apparent bandwidth 
and current available bandwidth, current propagation 
delay, latency, utilization by priority, hop count, 
duplex, and multiserver factors; 
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means responsive to selected said network evaluation 
parameters for analyzing average message length for all 
priorities, arrival rates, utilization, current window size, 
optimal window size, expected current average net- 
work response time, and utilization at which a response 
time requirement is not met; and 

means responsive to selected said network evaluation 
parameters for analyzing the throughput of said net- 
work. 

43. A program storage device readable by a machine, 
tangibly embodying a program of instructions executable by 
a machine to perform method steps for evaluating a com- 
munications network, said method steps comprising: 

probative testing a live communications network by selec- 
tively sending and receiving a plurality of network 
evaluation signals through said network; 

calculating and applying single and multiple links appar- 
ent queue factor to said network evaluation signals, for 
deriving network evaluation parameters including 
apparent bandwidth and current available bandwidth, 
current propagation delay, latency, utilization by 
priority, hop count, duplex, and multiserver factors; 

responsive to selected said network evaluation 
parameters, analyzing average message length for all 
priorities, arrival rates, utilization, current window size, 
optimal window size, expected current average net- 
work response time, and utilization at which a response 
time requirement is not met; and 

responsive to selected said network evaluation 
parameters, analyzing the throughput of said network, 

44. An article of manufacture comprising: a computer 
useable medium having computer readable program code 
means embodied therein for evaluating a communications 
network, the computer readable program means in said 
article of manufacture comprising: 

computer readable program code means for causing a 
computer to effect probative testing a live communi- 
cations network by selectively sending and receiving a 
plurality of network evaluation signals through said 
network; 

computer readable program code means for causing a 
computer to effect calculating and applying single and 
multiple links apparent queue factor to said network 
evaluation signals for selectively deriving and record- 
ing network evaluation parameters including apparent 
bandwidth and current available bandwidth, current 
propagation delay, latency, utilization by priority, hop 
count, duplex, and multiserver factors; 

computer readable program code means for causing a 
computer to effect responsive to selected said network 
evaluation parameters analyzing average message 
length for all priorities, arrival rates, utilization, current 
window size, optimal window size, expected current 
average network response time, and utilization at which 
a response time requirement is not met; and 

computer readable program code means for causing a 
computer to effect responsive to selected said network 
evaluation parameters analyzing the throughput of said 
network. 
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